Public bodies are subject to clear obligations to treat personal information with the appropriate sensitivity and security, but there is also an allied question as to how long such information should be kept for.
The High Court considered this very issue in the recent case of R(on the application of C) v (1) Northumberland County Council and (2) The Information Commissioner. The question before the Court was whether it was lawful for the Council to have a policy of retaining child protection records for 35 years after the case had been closed.
The Court considered the current landscape across the country and noted the divergent practice amongst public bodies in respect of their retention policies. They range from retaining the information up to the subject's 21st body to keeping hold of it until 75 years from the subject's date of birth. Clearly, there is no uniformity in approach and it will vary from case to case as to whether the retention period is lawful.
The Court decided that the Council's policy was indeed lawful, and in particular noted a number of characteristics which meant it was in the public interest to retain information for such a long period of time. Firstly, it was designed to protect other children. The information could be integral in future care proceedings. Secondly, it allowed those whose data was retained access to information which otherwise would not be available. Finally, it would make available information which could be of great importance to later investigations, enquiries or litigation. In respect of the latter, the judge noted the following:
"Records of the neglect and abuse of children may be of significant interest to criminal investigators and prosecutors many years after the events themselves; and it is plainly in the public interest that critical evidence be preserved to enable justice to be done..."
Clearly, this is currently of utmost importance with the various inquiries and investigations which have taken place recently into allegations of historic abuse. Without those records, effective investigation could be rendered very difficult indeed.
The net result is not that all public bodies should continue to hold records for 35 years, as the Council's policy was found to be "within the bracket of legitimate periods of retention" rather than the only legitimate retention period. The message to take away is all public bodies that hold highly sensitive information, particularly where there is a safeguarding element, need to think very carefully about the time for which they keep such information. This is in order to ensure that the policy serves the purposes set out above of protecting the data subject and others. It also needs to reflect the fact that information may not necessarily be of relevance now, but could well turn out to be of critical importance a long way into the future.
Alongside this, careful thought needs to be given to security and technical measures which are put in place in order to keep that information safe for the entirety of the time it is held.
Retention Of Highly Sensitive Information: How Long Is Too Long?
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
